Dating apps like Grindr and Tinder are sharing 'really sensitive' data: report

Read Story Transcript

Dating apps like Grindr, OkCupid and Tinder are sharing users' personal information — including their locations and sexual orientations — with potentially hundreds of shadowy third-party companies, a new report has found. 

The Norwegian Consumer Council, a government-funded non-profit organization, said it found "serious privacy infringements" in its analysis of online ad companies that track and profile smartphone users.

"I think we should be really worried because we've uncovered really pervasive tracking of users on our mobile phones, but at the same time uncovered that it's really hard for us to do anything about it as individuals," Finn Myrstad, the council's digital policy director, told As It Happens host Carol Off.

"Not only do you share [your data] with the app that you're using, but the app is in turn sharing it with maybe hundreds of other companies that you've never heard of."

LBGTQ and other vulnerable people at risk

The group commissioned cybersecurity company Mnemonic to study 10 Android mobile apps. It found that the apps sent user data to at least 135 different third-party services involved in advertising or behavioural profiling.

When it comes to dating apps, that data can be extremely personal, Myrstad said. It can include your sexual orientation, HIV status, religious beliefs and more. 

"We're really talking about really sensitive information," he said.

"That could be, for example, one dating app where you have to answer a questionnaire such as, 'What is your favourite cuddling position?' or if you've ever used drugs, and if so, what kind of drugs — so information that you'd probably like to keep private."

And that's just the information users are giving over willingly, he said. There's also another level of information that companies can extrapolate using things like location tracking.

"If I spend a lot of time at a mental-health clinic, it can reveal my mental state, for example," he said. 

Because people don't know which companies have which information, he says there's no way to be sure what it's being used for.

Companies could build user profiles and use those for nefarious or discriminatory purposes, he said, like blocking people from seeing housing ads based on demographics, or targeting vulnerable people with election disinformation.

"You can be ... triggered to, say, take up consumer debts or mortgages that are bad subprime purchases, payday loans and these sort of things because companies know about your vulnerabilities, and it's easier to target you because your clicks are tracked and your movements are tracked," he said. 

People who use Grindr — an app that caters exclusively to LGBTQ people — could risk being outed against their will, he said, or put in danger when they travel to countries where same-sex relationships are illegal.

"If you have the app, it's a pretty good indication that you're gay or bi," he said. "This can put people's life at risk."

'The privacy paradox'

The council took action against some of the companies it examined, filing formal complaints with Norway's data protection authority against Grindr, Twitter-owned mobile app advertising platform MoPub and four ad tech companies.

Grindr sent data including users' GPS location, age and gender to the other companies, the council said.

Twitter said it disabled Grindr's MoPub account and is investigating the issue "to understand the sufficiency of Grindr's consent mechanism."

In an emailed statement, Grindr said it is "currently implementing an enhanced consent management platform ... to provide users with additional in-app control regarding their personal data. " 

"While we reject a number of the report's assumptions and conclusions, we welcome the opportunity to be a small part in a larger conversation about how we can collectively evolve the practices of mobile publishers and continue to provide users with access to an option of a free platform," the company said.

"As the data protection landscape continues to change, our commitment to user privacy remains steadfast."

IAC, owner of The Match Group, which owns Tinder and OkCupid, said the company shares information with third parties only when it is "deemed necessary to operate its platform" with third-party apps. 

Myrstad says there's a commonly-held belief that people willingly waiver their privacy for the conveniences of modern technology — but he doesn't buy it.

"People are really concerned about their privacy, and they are really concerned about their cybersecurity and their safety," he said.

But in a modern context, he says people are offered a "take it or leave it choice" when it comes to apps, social media and dating services. 

"It's what we call the privacy paradox. People feel that they have no choice, so they sort of close their eyes and they click 'yes,'" he said.

"So what we're trying to do is to ensure that services have much more layered controls, that sharing is off by default ... so that people can be empowered again to make real choices."

Written by Sheena Goodyear with files from The Associated Press. Interview with Finn Myrstad produced by Morgan Passi.